Debugging production, running incidents and writing them up.
10 items at beginner level · all topics
A PVC with no storageClassName field is applied to a cluster and stays Pending. Which check explains it fastest?
A PVC that omits storageClassName uses the default StorageClass, marked by the storageclass.kubernetes.io/is-default-class annotation. With no default and no matching PV, the claim waits.
A Pod has been Pending for ten minutes. Which single command gives you the reason, and what should you expect to read in it?
kubectl describe pod shows the scheduler's FailedScheduling event, which names the reason node by node: insufficient CPU or memory, an untolerated taint, or no node matching the selector.
kubectl get pods shows a Pod with STATUS Running and READY 1/2, and requests to its Service are failing. What does that pair of columns tell you?
READY counts ready containers out of total containers in the Pod. At 1/2 the Pod is not ready, so it is left out of Service endpoints even though STATUS says Running.
A Pod is in ImagePullBackOff. Which TWO causes are consistent with that status?
ImagePullBackOff means the kubelet cannot fetch the image. A wrong name or tag and a missing registry credential are the two usual reasons, and the Pod's events name which one.
A Pod will not start and you need both the scheduling events and the exact resource requests as submitted. Which two commands give you those, and what does each leave out?
describe gives a human summary plus recent Events, which the YAML never contains. get -o yaml gives the exact stored object including defaults, which describe abbreviates.
A container is in CrashLoopBackOff and kubectl logs returns nothing useful because the container has just restarted. Which command shows the output from the failed run?
kubectl logs --previous returns the logs of the previous instantiation of the container, which is where the reason for the crash actually is.
A Pod is scheduled to a node but its status reads CreateContainerConfigError. The image pulled fine. What class of problem is this, and where do you look?
The kubelet could not assemble the container's configuration, usually because a referenced ConfigMap, Secret or key does not exist. The Pod events name the missing object.
You are asked to find out what happened in a namespace over the last few minutes. Which command gives the most useful ordered picture, and what limitation should you expect?
kubectl get events --sort-by=.lastTimestamp gives a namespace timeline. Events are namespaced and short-lived, retained for one hour by default, so older history is simply gone.
kubectl top nodes fails with an error saying the metrics API is not available, though every node is Ready and workloads are healthy. What does that indicate?
kubectl top reads the Metrics API, which is served by metrics-server rather than by the API server itself. Without it installed there is nothing to answer, and resource usage has to come from elsewhere.
On a fresh install, kubectl get nodes fails with a message about the connection to the server localhost:8080 being refused. What does that specific message mean?
localhost:8080 is kubectl's fallback when it finds no kubeconfig. The fix is to point it at a real one, usually by copying admin.conf into ~/.kube/config.